CVE-2025-5120
📋 TL;DR
This CVE describes a critical sandbox escape vulnerability in huggingface/smolagents version 1.14.0 that allows attackers to bypass execution restrictions and achieve remote code execution (RCE). The vulnerability undermines the core security boundary designed to isolate untrusted code, potentially compromising the host system. Anyone using the affected version of smolagents is at risk.
💻 Affected Systems
- huggingface/smolagents
📦 What is this software?
Smolagents by Huggingface
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with full remote code execution, data exfiltration, lateral movement, and persistent backdoor installation.
Likely Case
Unauthorized code execution leading to data leakage, system manipulation, and potential integration-level compromise of dependent systems.
If Mitigated
Limited impact with proper network segmentation and minimal privileges, though sandbox boundary is still breached.
🎯 Exploit Status
Exploit leverages whitelisted modules and functions to bypass restrictions. Public bounty details available at huntr.com.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.17.0
Vendor Advisory: https://github.com/huggingface/smolagents/commit/33a942e62b6fbf6a35d41f1c735bda2d64c163d0
Restart Required: Yes
Instructions:
1. Update smolagents to version 1.17.0 or later using pip: pip install --upgrade smolagents>=1.17.0
2. Restart any services or applications using smolagents
3. Verify the update was successful
🔧 Temporary Workarounds
Disable local_python_executor
allDisable or restrict usage of the vulnerable module if not required
Modify application configuration to avoid using local_python_executor functionality
Network isolation
allIsolate systems running vulnerable version from sensitive networks
Implement firewall rules to restrict inbound/outbound connections
🧯 If You Can't Patch
- Implement strict network segmentation to isolate vulnerable systems
- Apply principle of least privilege and monitor for suspicious process execution
🔍 How to Verify
Check if Vulnerable:
Check if smolagents version is 1.14.0: python -c "import smolagents; print(smolagents.__version__)"Check Version:
python -c "import smolagents; print(smolagents.__version__)"Verify Fix Applied:
Verify version is 1.17.0 or higher: python -c "import smolagents; print(smolagents.__version__)"📡 Detection & Monitoring
Log Indicators:
- Unusual Python module imports
- Suspicious process execution from smolagents context
- Sandbox escape attempts in application logs
Network Indicators:
- Unexpected outbound connections from smolagents processes
- Data exfiltration patterns
SIEM Query:
Process creation where parent process contains 'smolagents' AND command line contains suspicious Python execution patterns